Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-116606 |
| Alert Source | CISA KEV - Active Exploitation |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-10 |
| Vendor | Barracuda Networks |
| Product | Barracuda Email Security Gateway (ESG) |
| Vulnerability Type | authentication bypass using an alternate path (CWE-288) |
| CVSS Score | 9.3 (critical, CVSS 4.0) |
| EPSS Score | 1.6% (percentile: 76%) |
| CISA KEV | Yes - confirmed active exploitation |
| Ransomware | Not confirmed |
| Remediation Deadline | 2026-11-13 |
Vulnerability Description
Barracuda Networks Email Security Gateway (ESG) versions earlier than 9.4.0.030 contain an authentication bypass using an alternate path or channel. An unauthenticated remote attacker can invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.
The flaw can be chained with CVE-2026-111560 (command injection in the timezone field), giving an attacker without credentials code execution as root. CISA has confirmed active exploitation and set a remediation deadline of November 13, 2026 for US federal agencies. The issue was reported by Mandiant (MNDT-2026-0042).
Required Actions
- Update Barracuda ESG to version 9.4.0.030 or later and apply any other guidance from the vendor advisory.
- Restrict access to the gateway’s management interface to trusted addresses.
- Compare the current appliance configuration with the last known-good backup — look for unauthorized changes (mail forwarding rules, accounts, timezone).
- Review logs for configuration-import calls and unusual activity; if in doubt, treat the appliance as compromised.
Who Is Affected?
The vulnerability affects Barracuda Email Security Gateway versions earlier than 9.4.0.030. Compromising an email gateway exposes mail traffic and provides a foothold in the network.
Sources
- NVD - CVE-2026-116606
- Barracuda Trust Center - security advisory
- Mandiant MNDT-2026-0042
- CISA KEV Catalog
- FIRST EPSS
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
What is the CVE-2026-116606 vulnerability?
CVE-2026-116606 is an authentication bypass (CWE-288) in Barracuda Email Security Gateway that lets an attacker restore a crafted configuration backup without logging in. CVSS 4.0 score: 9.3; the flaw is listed in the CISA KEV catalog.
Does exploiting CVE-2026-116606 require authentication?
No. The attack is carried out remotely over the network and requires no authentication.
How to protect against CVE-2026-116606?
Update ESG to 9.4.0.030 or later, remove internet access to the admin panel and check the appliance configuration for unauthorized changes. The CISA deadline is November 13, 2026.
Who is affected by CVE-2026-116606?
Organizations running Barracuda Email Security Gateway versions earlier than 9.4.0.030.
